thinkwork-cli 0.12.11 → 0.12.15

package/dist/drizzle/0170_email_channel_plugin.sql

@@ -0,0 +1,291 @@
+-- Purpose: add provider-neutral Email Channel plugin state, policy, ledger, and SES compatibility tables.
+-- Plan: docs/plans/2026-06-17-003-feat-email-channel-plugin-plan.md (U2)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0170_email_channel_plugin.sql
+-- creates: public.email_provider_installs
+-- creates: public.email_domains
+-- creates: public.email_readiness_checks
+-- creates: public.email_space_policies
+-- creates: public.email_space_sender_allowlists
+-- creates: public.email_conversations
+-- creates: public.email_body_objects
+-- creates: public.email_ledger_events
+-- creates: public.email_provider_events
+-- creates: public.email_ses_compatibility_mappings
+-- creates: public.uq_email_provider_installs_tenant_provider
+-- creates: public.uq_email_provider_installs_active
+-- creates: public.idx_email_provider_installs_tenant
+-- creates: public.idx_email_provider_installs_provider_status
+-- creates: public.uq_email_domains_tenant_domain
+-- creates: public.idx_email_domains_provider
+-- creates: public.idx_email_domains_tenant_status
+-- creates: public.uq_email_readiness_check_scope
+-- creates: public.idx_email_readiness_provider
+-- creates: public.idx_email_readiness_tenant_status
+-- creates: public.uq_email_space_policies_space
+-- creates: public.idx_email_space_policies_provider
+-- creates: public.uq_email_sender_allowlist_value
+-- creates: public.idx_email_sender_allowlist_space
+-- creates: public.idx_email_conversations_tenant_status
+-- creates: public.idx_email_conversations_space
+-- creates: public.idx_email_conversations_thread
+-- creates: public.uq_email_conversations_thread_participants
+-- creates: public.idx_email_body_objects_conversation
+-- creates: public.idx_email_body_objects_retention
+-- creates: public.idx_email_ledger_tenant_created
+-- creates: public.idx_email_ledger_conversation
+-- creates: public.idx_email_ledger_space
+-- creates: public.idx_email_ledger_provider_message
+-- creates: public.uq_email_provider_events_provider_event
+-- creates: public.idx_email_provider_events_message
+-- creates: public.idx_email_provider_events_type_created
+-- creates: public.uq_email_ses_mapping_token
+-- creates: public.idx_email_ses_mapping_message
+-- creates: public.idx_email_ses_mapping_conversation
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS public.email_provider_installs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  display_name text,
+  status text NOT NULL DEFAULT 'pending',
+  active_for_production boolean NOT NULL DEFAULT false,
+  credential_secret_ref text,
+  webhook_secret_ref text,
+  default_from_email text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_provider_installs_provider_allowed CHECK (provider IN ('resend', 'ses')),
+  CONSTRAINT email_provider_installs_status_allowed CHECK (status IN ('pending', 'ready', 'failed', 'disabled'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_provider_installs_active
+  ON public.email_provider_installs (tenant_id)
+  WHERE active_for_production = true;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_provider_installs_tenant_provider
+  ON public.email_provider_installs (tenant_id, provider);
+CREATE INDEX IF NOT EXISTS idx_email_provider_installs_tenant
+  ON public.email_provider_installs (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_email_provider_installs_provider_status
+  ON public.email_provider_installs (tenant_id, provider, status);
+
+CREATE TABLE IF NOT EXISTS public.email_domains (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider_install_id uuid NOT NULL REFERENCES public.email_provider_installs(id) ON DELETE CASCADE,
+  domain text NOT NULL,
+  ownership_type text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  sending_verified_at timestamptz,
+  inbound_verified_at timestamptz,
+  dns_records jsonb NOT NULL DEFAULT '{}'::jsonb,
+  provider_metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_domains_ownership_allowed CHECK (ownership_type IN ('thinkwork_owned', 'customer_owned')),
+  CONSTRAINT email_domains_status_allowed CHECK (status IN ('pending', 'verified', 'failed', 'disabled'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_domains_tenant_domain
+  ON public.email_domains (tenant_id, domain);
+CREATE INDEX IF NOT EXISTS idx_email_domains_provider
+  ON public.email_domains (provider_install_id);
+CREATE INDEX IF NOT EXISTS idx_email_domains_tenant_status
+  ON public.email_domains (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.email_readiness_checks (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider_install_id uuid NOT NULL REFERENCES public.email_provider_installs(id) ON DELETE CASCADE,
+  domain_id uuid REFERENCES public.email_domains(id) ON DELETE CASCADE,
+  check_key text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  last_checked_at timestamptz,
+  failure_code text,
+  failure_message text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_readiness_check_key_allowed CHECK (check_key IN ('credentials', 'sending_domain', 'inbound_receiving', 'webhook_signature', 'provider_events', 'loop_test')),
+  CONSTRAINT email_readiness_status_allowed CHECK (status IN ('pending', 'pass', 'fail', 'blocked'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_readiness_check_scope
+  ON public.email_readiness_checks (
+    tenant_id,
+    provider_install_id,
+    COALESCE(domain_id, '00000000-0000-0000-0000-000000000000'::uuid),
+    check_key
+  );
+CREATE INDEX IF NOT EXISTS idx_email_readiness_provider
+  ON public.email_readiness_checks (provider_install_id);
+CREATE INDEX IF NOT EXISTS idx_email_readiness_tenant_status
+  ON public.email_readiness_checks (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.email_space_policies (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  provider_install_id uuid REFERENCES public.email_provider_installs(id) ON DELETE SET NULL,
+  enabled boolean NOT NULL DEFAULT false,
+  registered_users_allowed boolean NOT NULL DEFAULT true,
+  private_space_membership_required boolean NOT NULL DEFAULT true,
+  outside_sender_default text NOT NULL DEFAULT 'deny',
+  first_send_review_required boolean NOT NULL DEFAULT true,
+  policy jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_space_policies_outside_default_allowed CHECK (outside_sender_default IN ('deny', 'allowlist'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_space_policies_space
+  ON public.email_space_policies (tenant_id, space_id);
+CREATE INDEX IF NOT EXISTS idx_email_space_policies_provider
+  ON public.email_space_policies (provider_install_id);
+
+CREATE TABLE IF NOT EXISTS public.email_space_sender_allowlists (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  value_type text NOT NULL,
+  value text NOT NULL,
+  reason text,
+  created_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_sender_allowlist_type_allowed CHECK (value_type IN ('email', 'domain'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_sender_allowlist_value
+  ON public.email_space_sender_allowlists (tenant_id, space_id, value_type, value);
+CREATE INDEX IF NOT EXISTS idx_email_sender_allowlist_space
+  ON public.email_space_sender_allowlists (tenant_id, space_id);
+
+CREATE TABLE IF NOT EXISTS public.email_conversations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid REFERENCES public.spaces(id) ON DELETE SET NULL,
+  thread_id uuid REFERENCES public.threads(id) ON DELETE SET NULL,
+  provider_install_id uuid REFERENCES public.email_provider_installs(id) ON DELETE SET NULL,
+  subject text,
+  status text NOT NULL DEFAULT 'pending_approval',
+  approved_at timestamptz,
+  approved_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  last_message_at timestamptz,
+  participant_hash text NOT NULL,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_conversations_status_allowed CHECK (status IN ('pending_approval', 'approved', 'closed', 'blocked'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_email_conversations_tenant_status
+  ON public.email_conversations (tenant_id, status);
+CREATE INDEX IF NOT EXISTS idx_email_conversations_space
+  ON public.email_conversations (tenant_id, space_id);
+CREATE INDEX IF NOT EXISTS idx_email_conversations_thread
+  ON public.email_conversations (thread_id);
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_conversations_thread_participants
+  ON public.email_conversations (tenant_id, thread_id, participant_hash)
+  WHERE thread_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS public.email_body_objects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  conversation_id uuid REFERENCES public.email_conversations(id) ON DELETE CASCADE,
+  direction text NOT NULL,
+  content_hash text NOT NULL,
+  object_ref text NOT NULL,
+  retention_until timestamptz NOT NULL,
+  redacted_at timestamptz,
+  redacted_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  redaction_reason text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_body_objects_direction_allowed CHECK (direction IN ('inbound', 'outbound'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_email_body_objects_conversation
+  ON public.email_body_objects (conversation_id);
+CREATE INDEX IF NOT EXISTS idx_email_body_objects_retention
+  ON public.email_body_objects (tenant_id, retention_until);
+
+CREATE TABLE IF NOT EXISTS public.email_ledger_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  conversation_id uuid REFERENCES public.email_conversations(id) ON DELETE SET NULL,
+  space_id uuid REFERENCES public.spaces(id) ON DELETE SET NULL,
+  thread_id uuid REFERENCES public.threads(id) ON DELETE SET NULL,
+  message_id uuid REFERENCES public.messages(id) ON DELETE SET NULL,
+  inbox_item_id uuid REFERENCES public.inbox_items(id) ON DELETE SET NULL,
+  provider_install_id uuid REFERENCES public.email_provider_installs(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  provider_message_id text,
+  provider_event_id text,
+  actor_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  body_object_id uuid REFERENCES public.email_body_objects(id) ON DELETE SET NULL,
+  subject text,
+  from_email text,
+  to_emails jsonb NOT NULL DEFAULT '[]'::jsonb,
+  reason_code text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_ledger_events_type_allowed CHECK (event_type IN ('draft_created', 'approval_requested', 'approval_approved', 'approval_denied', 'send_blocked', 'send_attempted', 'send_succeeded', 'send_failed', 'inbound_received', 'inbound_authorized', 'inbound_rejected', 'provider_event', 'readiness_check', 'body_retained', 'body_redacted'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_email_ledger_tenant_created
+  ON public.email_ledger_events (tenant_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_email_ledger_conversation
+  ON public.email_ledger_events (conversation_id);
+CREATE INDEX IF NOT EXISTS idx_email_ledger_space
+  ON public.email_ledger_events (tenant_id, space_id);
+CREATE INDEX IF NOT EXISTS idx_email_ledger_provider_message
+  ON public.email_ledger_events (tenant_id, provider_message_id);
+
+CREATE TABLE IF NOT EXISTS public.email_provider_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider_install_id uuid NOT NULL REFERENCES public.email_provider_installs(id) ON DELETE CASCADE,
+  ledger_event_id uuid REFERENCES public.email_ledger_events(id) ON DELETE SET NULL,
+  provider_event_id text NOT NULL,
+  provider_message_id text,
+  event_type text NOT NULL,
+  occurred_at timestamptz,
+  payload_metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT email_provider_events_type_allowed CHECK (event_type IN ('sent', 'delivered', 'delayed', 'failed', 'bounced', 'complained', 'opened', 'clicked', 'received'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_provider_events_provider_event
+  ON public.email_provider_events (provider_install_id, provider_event_id);
+CREATE INDEX IF NOT EXISTS idx_email_provider_events_message
+  ON public.email_provider_events (tenant_id, provider_message_id);
+CREATE INDEX IF NOT EXISTS idx_email_provider_events_type_created
+  ON public.email_provider_events (provider_install_id, event_type, created_at);
+
+CREATE TABLE IF NOT EXISTS public.email_ses_compatibility_mappings (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider_install_id uuid NOT NULL REFERENCES public.email_provider_installs(id) ON DELETE CASCADE,
+  reply_token_id uuid REFERENCES public.email_reply_tokens(id) ON DELETE SET NULL,
+  conversation_id uuid REFERENCES public.email_conversations(id) ON DELETE SET NULL,
+  ses_message_id text,
+  legacy_thread_id uuid REFERENCES public.threads(id) ON DELETE SET NULL,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_email_ses_mapping_token
+  ON public.email_ses_compatibility_mappings (reply_token_id);
+CREATE INDEX IF NOT EXISTS idx_email_ses_mapping_message
+  ON public.email_ses_compatibility_mappings (tenant_id, ses_message_id);
+CREATE INDEX IF NOT EXISTS idx_email_ses_mapping_conversation
+  ON public.email_ses_compatibility_mappings (conversation_id);
+
+COMMIT;

package/dist/drizzle/0171_linked_task_external_providers.sql

@@ -0,0 +1,30 @@
+-- Purpose: allow Twenty task-event server-contract smoke without native Twenty app install.
+-- Plan: THNK-33 Twenty Server Contract Verification (server_contract_verified only)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0171_linked_task_external_providers.sql
+-- creates-constraint: public.linked_tasks.linked_tasks_provider_allowed
+-- creates-constraint: public.linked_task_events.linked_task_events_provider_allowed
+-- creates-constraint: public.linked_task_events.linked_task_events_type_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+ALTER TABLE public.linked_tasks
+  DROP CONSTRAINT IF EXISTS linked_tasks_provider_allowed,
+  ADD CONSTRAINT linked_tasks_provider_allowed
+    CHECK (provider IN ('lastmile', 'thinkwork', 'twenty'));
+
+ALTER TABLE public.linked_task_events
+  DROP CONSTRAINT IF EXISTS linked_task_events_provider_allowed,
+  ADD CONSTRAINT linked_task_events_provider_allowed
+    CHECK (provider IN ('lastmile', 'thinkwork', 'twenty'));
+
+ALTER TABLE public.linked_task_events
+  DROP CONSTRAINT IF EXISTS linked_task_events_type_allowed,
+  ADD CONSTRAINT linked_task_events_type_allowed
+    CHECK (event_type IN ('created', 'status_changed', 'completed', 'blocked', 'reassigned', 'due_date_changed', 'comment_added', 'sync_failed', 'writeback_posted'));
+
+COMMIT;

package/dist/drizzle/0172_email_channel_sendgrid_provider.sql

@@ -0,0 +1,8 @@
+-- creates-constraint: public.email_provider_installs.email_provider_installs_provider_allowed
+
+ALTER TABLE public.email_provider_installs
+  DROP CONSTRAINT IF EXISTS email_provider_installs_provider_allowed;
+
+ALTER TABLE public.email_provider_installs
+  ADD CONSTRAINT email_provider_installs_provider_allowed
+  CHECK (provider IN ('resend', 'sendgrid', 'ses'));

package/dist/drizzle/0173_auth_provider_resources.sql

@@ -0,0 +1,83 @@
+-- creates: public.auth_provider_resources
+-- creates: public.tenant_auth_provider_references
+-- creates: public.uq_auth_provider_resources_cognito_idp
+-- creates: public.idx_auth_provider_resources_provider_status
+-- creates: public.uq_tenant_auth_provider_references_install_resource
+-- creates: public.idx_tenant_auth_provider_references_tenant_status
+-- creates: public.idx_tenant_auth_provider_references_resource
+
+ALTER TABLE public.plugin_components
+  DROP CONSTRAINT IF EXISTS plugin_components_type_allowed;
+
+ALTER TABLE public.plugin_components
+  ADD CONSTRAINT plugin_components_type_allowed
+  CHECK (component_type IN ('mcp-server', 'skills', 'infrastructure', 'ui-surface', 'auth-provider'));
+
+CREATE TABLE IF NOT EXISTS public.auth_provider_resources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  provider_key text NOT NULL,
+  display_name text NOT NULL,
+  cognito_user_pool_id text NOT NULL,
+  cognito_app_client_ids jsonb DEFAULT '[]'::jsonb NOT NULL,
+  cognito_identity_provider_name text NOT NULL,
+  issuer_url text NOT NULL,
+  client_id text NOT NULL,
+  client_secret_ref text NOT NULL,
+  authorize_scopes text DEFAULT 'openid profile email' NOT NULL,
+  public_option_mode text DEFAULT 'single_sso' NOT NULL,
+  provider_options jsonb DEFAULT '[]'::jsonb NOT NULL,
+  validation_status text DEFAULT 'unconfigured' NOT NULL,
+  public_options_published boolean DEFAULT false NOT NULL,
+  last_validated_at timestamp with time zone,
+  last_error_code text,
+  diagnostics jsonb DEFAULT '{}'::jsonb NOT NULL,
+  created_at timestamp with time zone DEFAULT now() NOT NULL,
+  updated_at timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT auth_provider_resources_validation_status_allowed
+    CHECK (validation_status IN ('unconfigured', 'validating', 'valid', 'partially_valid', 'invalid', 'rotating_secret', 'disabled')),
+  CONSTRAINT auth_provider_resources_public_option_mode_allowed
+    CHECK (public_option_mode IN ('single_sso', 'provider_specific')),
+  CONSTRAINT auth_provider_resources_no_public_without_valid
+    CHECK (public_options_published = false OR validation_status IN ('valid', 'partially_valid'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_auth_provider_resources_cognito_idp
+  ON public.auth_provider_resources (
+    provider_key,
+    cognito_user_pool_id,
+    cognito_identity_provider_name
+  );
+
+CREATE INDEX IF NOT EXISTS idx_auth_provider_resources_provider_status
+  ON public.auth_provider_resources (provider_key, validation_status);
+
+CREATE TABLE IF NOT EXISTS public.tenant_auth_provider_references (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  plugin_install_id uuid NOT NULL REFERENCES public.plugin_installs(id) ON DELETE CASCADE,
+  auth_provider_resource_id uuid NOT NULL REFERENCES public.auth_provider_resources(id) ON DELETE CASCADE,
+  status text DEFAULT 'disabled' NOT NULL,
+  hostnames jsonb DEFAULT '[]'::jsonb NOT NULL,
+  public_option_label text DEFAULT 'Continue with SSO' NOT NULL,
+  enabled_at timestamp with time zone,
+  disabled_at timestamp with time zone,
+  last_error_code text,
+  metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+  created_at timestamp with time zone DEFAULT now() NOT NULL,
+  updated_at timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT tenant_auth_provider_references_status_allowed
+    CHECK (status IN ('disabled', 'enabled', 'invalid', 'decommissioning'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tenant_auth_provider_references_install_resource
+  ON public.tenant_auth_provider_references (
+    tenant_id,
+    plugin_install_id,
+    auth_provider_resource_id
+  );
+
+CREATE INDEX IF NOT EXISTS idx_tenant_auth_provider_references_tenant_status
+  ON public.tenant_auth_provider_references (tenant_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_auth_provider_references_resource
+  ON public.tenant_auth_provider_references (auth_provider_resource_id);

package/dist/drizzle/0174_workos_auth_bridges.sql

@@ -0,0 +1,37 @@
+-- THNK-43 U2: short-lived WorkOS primary-auth bridge records.
+-- creates: public.workos_auth_bridges
+-- creates: public.uq_workos_auth_bridges_code_digest
+-- creates: public.idx_workos_auth_bridges_tenant_status
+-- creates: public.idx_workos_auth_bridges_reference
+
+CREATE TABLE IF NOT EXISTS workos_auth_bridges (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  tenant_auth_provider_reference_id uuid NOT NULL REFERENCES tenant_auth_provider_references(id) ON DELETE CASCADE,
+  auth_provider_resource_id uuid NOT NULL REFERENCES auth_provider_resources(id) ON DELETE CASCADE,
+  bridge_code_digest text NOT NULL,
+  workos_user_id text NOT NULL,
+  workos_session_id text NOT NULL,
+  workos_email text NOT NULL,
+  workos_email_verified boolean NOT NULL DEFAULT false,
+  workos_profile jsonb NOT NULL DEFAULT '{}'::jsonb,
+  state_nonce text NOT NULL,
+  redirect_uri text NOT NULL,
+  return_to text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  expires_at timestamptz NOT NULL,
+  consumed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT workos_auth_bridges_status_allowed
+    CHECK (status IN ('pending', 'consumed', 'expired'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_workos_auth_bridges_code_digest
+  ON workos_auth_bridges (bridge_code_digest);
+
+CREATE INDEX IF NOT EXISTS idx_workos_auth_bridges_tenant_status
+  ON workos_auth_bridges (tenant_id, status, expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_workos_auth_bridges_reference
+  ON workos_auth_bridges (tenant_auth_provider_reference_id);

package/dist/drizzle/0175_workos_auth_sessions.sql

@@ -0,0 +1,38 @@
+-- 0175_workos_auth_sessions.sql
+-- creates-column: public.workos_auth_bridges.workos_session_expires_at
+-- creates: public.workos_auth_sessions
+-- creates: public.idx_workos_auth_sessions_cognito_active
+-- creates: public.idx_workos_auth_sessions_user_active
+-- creates: public.idx_workos_auth_sessions_workos_session
+
+ALTER TABLE workos_auth_bridges
+  ADD COLUMN IF NOT EXISTS workos_session_expires_at timestamptz;
+
+CREATE TABLE IF NOT EXISTS workos_auth_sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  tenant_auth_provider_reference_id uuid NOT NULL REFERENCES tenant_auth_provider_references(id) ON DELETE CASCADE,
+  auth_provider_resource_id uuid NOT NULL REFERENCES auth_provider_resources(id) ON DELETE CASCADE,
+  cognito_principal_id text NOT NULL,
+  cognito_username text NOT NULL,
+  workos_user_id text NOT NULL,
+  workos_session_id text NOT NULL,
+  workos_email text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  expires_at timestamptz NOT NULL,
+  logged_out_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT workos_auth_sessions_status_allowed
+    CHECK (status IN ('active', 'logged_out', 'expired'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_workos_auth_sessions_cognito_active
+  ON workos_auth_sessions (cognito_principal_id, status, expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_workos_auth_sessions_user_active
+  ON workos_auth_sessions (tenant_id, user_id, status, expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_workos_auth_sessions_workos_session
+  ON workos_auth_sessions (workos_session_id);

package/dist/drizzle/0176_n8n_agent_step_runs.sql

@@ -0,0 +1,107 @@
+-- n8n agent-step bridge run ledger.
+--
+-- Apply manually before deploying bridge endpoint code:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0176_n8n_agent_step_runs.sql
+--
+-- creates: public.n8n_agent_step_runs
+-- creates: public.n8n_agent_step_runs_tenant_idempotency_uidx
+-- creates: public.n8n_agent_step_runs_tenant_status_idx
+-- creates: public.n8n_agent_step_runs_thread_idx
+-- creates: public.n8n_agent_step_runs_n8n_execution_idx
+-- creates: public.n8n_agent_step_runs_due_expiry_idx
+-- creates: public.n8n_agent_step_runs_resume_pending_idx
+-- creates-constraint: public.n8n_agent_step_runs.n8n_agent_step_runs_status_check
+-- creates-constraint: public.n8n_agent_step_runs.n8n_agent_step_runs_resume_status_check
+-- creates-constraint: public.n8n_agent_step_runs.n8n_agent_step_runs_timeout_bounds_check
+-- creates-constraint: public.n8n_agent_step_runs.n8n_agent_step_runs_terminal_state_check
+
+CREATE TABLE IF NOT EXISTS "n8n_agent_step_runs" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE cascade,
+  "plugin_install_id" uuid REFERENCES "plugin_installs"("id") ON DELETE set null,
+  "managed_application_id" uuid REFERENCES "managed_applications"("id") ON DELETE set null,
+  "space_id" uuid NOT NULL REFERENCES "spaces"("id") ON DELETE restrict,
+  "agent_id" uuid REFERENCES "agents"("id") ON DELETE set null,
+  "thread_id" uuid REFERENCES "threads"("id") ON DELETE set null,
+  "thread_turn_id" uuid REFERENCES "thread_turns"("id") ON DELETE set null,
+  "opening_message_id" uuid REFERENCES "messages"("id") ON DELETE set null,
+  "status" text NOT NULL DEFAULT 'accepted',
+  "resume_status" text NOT NULL DEFAULT 'not_ready',
+  "workflow_id" text NOT NULL,
+  "workflow_name" text,
+  "execution_id" text NOT NULL,
+  "step_id" text NOT NULL,
+  "correlation_id" text NOT NULL,
+  "request_id" text,
+  "idempotency_key" text NOT NULL,
+  "instructions_preview" text,
+  "input_preview" text,
+  "request_metadata" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "resume_url_secret_ref" text,
+  "resume_url_host" text,
+  "resume_url_path" text,
+  "timeout_seconds" integer NOT NULL,
+  "expires_at" timestamp with time zone NOT NULL,
+  "result_payload" jsonb,
+  "output_payload" jsonb,
+  "error_payload" jsonb,
+  "summary" text,
+  "links" jsonb,
+  "resume_attempt_count" integer NOT NULL DEFAULT 0,
+  "next_resume_attempt_at" timestamp with time zone,
+  "last_resume_attempt_at" timestamp with time zone,
+  "last_resume_http_status" integer,
+  "last_resume_error" text,
+  "resumed_at" timestamp with time zone,
+  "terminal_at" timestamp with time zone,
+  "accepted_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "n8n_agent_step_runs_status_check"
+    CHECK ("status" IN (
+      'accepted',
+      'waiting',
+      'awaiting_human',
+      'resume_pending',
+      'resuming',
+      'resumed',
+      'resume_failed',
+      'failed',
+      'expired'
+    )),
+  CONSTRAINT "n8n_agent_step_runs_resume_status_check"
+    CHECK ("resume_status" IN (
+      'not_ready',
+      'pending',
+      'resuming',
+      'resumed',
+      'failed'
+    )),
+  CONSTRAINT "n8n_agent_step_runs_timeout_bounds_check"
+    CHECK ("timeout_seconds" BETWEEN 300 AND 604800),
+  CONSTRAINT "n8n_agent_step_runs_terminal_state_check"
+    CHECK (
+      "status" NOT IN ('resumed', 'resume_failed', 'failed', 'expired')
+      OR "terminal_at" IS NOT NULL
+    )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "n8n_agent_step_runs_tenant_idempotency_uidx"
+  ON "n8n_agent_step_runs" ("tenant_id", "idempotency_key");
+
+CREATE INDEX IF NOT EXISTS "n8n_agent_step_runs_tenant_status_idx"
+  ON "n8n_agent_step_runs" ("tenant_id", "status");
+
+CREATE INDEX IF NOT EXISTS "n8n_agent_step_runs_thread_idx"
+  ON "n8n_agent_step_runs" ("tenant_id", "thread_id");
+
+CREATE INDEX IF NOT EXISTS "n8n_agent_step_runs_n8n_execution_idx"
+  ON "n8n_agent_step_runs" ("tenant_id", "workflow_id", "execution_id");
+
+CREATE INDEX IF NOT EXISTS "n8n_agent_step_runs_due_expiry_idx"
+  ON "n8n_agent_step_runs" ("tenant_id", "expires_at")
+  WHERE "status" IN ('accepted', 'waiting', 'awaiting_human');
+
+CREATE INDEX IF NOT EXISTS "n8n_agent_step_runs_resume_pending_idx"
+  ON "n8n_agent_step_runs" ("tenant_id", "next_resume_attempt_at")
+  WHERE "status" = 'resume_pending';